Privatizing Surveillance

The Office of the Privacy Commissioner of Canada (OPC) is an advocate for the privacy of the rights of Canadians. The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal privacy law from which the OPC derives its authority. There has been much debate in recent years about whether the OPC has the ability to regulate how private organizations such as insurance companies conduct covert video surveillance of individuals about which they seek to obtain further information.

According to the OPC, private sector privacy laws require an organization to balance its need to conduct a video surveillance with the individ- ual’s right to privacy, which includes the right to lead lives free from scrutiny.

The OPC rendered a decision in August 2008 regarding images of a third party that a private investigative firm collected during covert surveillance on behalf on an insurer. In its decision, the OPC held private investigators should mask or pixilate any third party image as soon as possible after collection, and before disclosure to insurer clients.

Subsequent to its decision, in May 2009, the OPC released a set of guidelines with respect to video surveillance in the private sector “to help organizations achieve compliance with private sector privacy legislation.” 1 The guidelines stipulate that covert video surveillance in the private sector that captures images of identifiable individuals is considered to be a collection of personal information.

Organizations contemplating the use of covert video surveillance should be aware of the criteria the OPC says must be satisfied in order to collect, use, and disclose video surveillance images in compliance with PIPEDA. Organizations are not released from their privacy obligations if covert video surveillance is conducted in a public place. Any collection of personal information taking place in the course of commercial activity, regardless of the location, must conform to the requirements in the guidelines.

CONDUCTING SURVEILLANCE IN ACCORDANCE WITH THE GUIDELINES

The insurance industry should be aware that the OPC guidelines are only guidelines. They are not law. However, if a complaint is made to the OPC, it will certainly require time and effort to prepare a response. Currently it is unclear what the other consequences may be for failing to comply with the guidelines. State Farm Insurance is currently challenging the OPC’s jurisdiction to regulate the private sector in this way.

Until the court resolves the above-noted issues, it is recommended that organizations comply with the guidelines to the best of their ability. Here is a summary of some steps that should be taken in an attempt to ensure that covert surveillance is conducted in accordance with the guidelines.

ATTEMPT TO OBTAIN INFORMATION USING OTHER, LESS-INVASIVE MEANS

The OPC takes the position that covert surveillance should be used as an investigative tool of last resort. Any organization contemplating the use of covert video surveillance should consider other means of collecting the personal information first, given the inherent intrusiveness of covert video surveillance.

ESTABLISH THAT THERE IS A PURPOSE FOR THE SURVEILLANCE

The starting point for an organization that is contemplating putting an individual under surveillance without their knowledge is to establish what purpose the surveillance aims to achieve. There must be a demonstrable, evidentiary need for the collection, and it must be for a legitimate business purpose. In other words, it is not enough for the organization to be acting on a mere suspicion. There should also be a strong likelihood that collecting the personal information will help the organization achieve its stated objective.

LIMIT THE TYPE AND THE AMOUNT OF INFORMATION OBTAINED

Organizations must take care to limit both the type and amount of information to that which is necessary to fulfill the identified purposes. If personal information of third parties is captured, it should be deleted or depersonalized “as soon as practicable” (the OPC has not indicated how quickly this should be done).This refers not only to images of the individuals themselves, but also to any information that could serve to identify them, such as street numbers and license plates. The OPC advocates the use of blurring technology when required.

DOCUMENT INVESTIGATIONS AND OTHER MATTERS RELATED TO THE SURVEILLANCE

Organizations must document to ensure that privacy obligations are respected and to protect the organization in the event of a privacy complaint. There should be a documented record of:

• a description of alternative measures undertaken and their result;

• a description of the kind of information collected;

• the duration of surveillance;

• names of individuals who viewed the surveillance;

• what the surveillance was used for;

• when and how images were disposed of; and

• a service agreement with any third party that is hired to conduct the surveillance that complies with the guidelines.

DEVELOP A POLICY ON COVERT VIDEO SURVEILLANCE

The OPC recommends that organizations using covert video surveillance should implement a policy that:

• establishes privacy-specific criteria that must be met before covert video surveillance is undertaken;

• requires that the decision be documented, including rationale and purpose;

• requires that authorization for undertaking video surveillance be given at an appropriate level of the organization;

• limits the collection of personal information to that which is necessary to achieve the stated purpose;

• limits the use of the surveillance to its stated purpose;

• requires that the surveillance be stored in a secure manner;

• designates the persons in the organization authorized to view the surveillance;

• establishes procedures for dealing with third-party information;

• establishes a retention period for the surveillance; and

• establishes procedures for the secure disposal of images.

CONCLUSION

The OPC guidelines are only guidelines; they are not law. The extent to which the OPC can regulate the private sector remains unclear. If covert surveillance is not done in compliance with the guidelines, this may result in time and expense spent in responding to a privacy complaint.

It is recommended that organizations wishing to carry out covert surveillance review the guidelines carefully before they embark on conducting surveillance. A policy statement should be established and procedures in keeping with the guidelines should be adopted. If third parties are retained to conduct surveillance, there should be an agreement in place setting out that investigations conducted will be in compliance with the guidelines.

1 The guidelines may be viewed online at

http://www.priv.gc.ca/information/pub/gd_cvs_20090527_e.cfm

———

When it comes to insurance investigations and privacy law, insurers would be well-advised to follow guidelines recently published by the Office of the Privacy Commissioner.